{"data":{"id":2397,"lang":"en","title":"Plugin4Shell Flaw Lets Attackers Hijack Claude Code, Codex, Copilot and Gemini CLI Without a Click","summary":"Air researchers found that pinned plugins in four AI coding agents can be swapped for malicious code; Anthropic and OpenAI have patched, Copilot has not.","category":"technology","category_label":"Technology","published_at":"2026-09-18T22:00:59Z","updated_at":"2026-09-18T22:00:59Z","url":"https://techtools.cz/tools/news/article/2397-plugin4shell-flaw-lets-attackers-hijack-claude-code-codex-copilot-and-gemini","api_url":"https://techtools.cz/news-api/v1/articles/2397?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/2397.md?lang=en","image_url":"https://img2.helpnetsecurity.com/posts2026/AI_coding_agents_vulnerability.webp","word_count":162,"reading_time_minutes":1,"sources":[{"url":"https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/","domain":"helpnetsecurity.com"},{"url":"https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/5297335","domain":"theregister.com"},{"url":"https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html","domain":"thehackernews.com"}],"translation":{"lang":"cs","id":2470,"title":"Chyba Plugin4Shell umožňuje bez kliknutí ovládnout Claude Code, Codex, Copilot i Gemini CLI","url":"https://techtools.cz/tools/news/clanek/2470-chyba-plugin4shell-umoznuje-bez-kliknuti-ovladnout-claude-code-codex-copilot-i","api_url":"https://techtools.cz/news-api/v1/articles/2470?lang=cs"},"content":"Security startup Air disclosed \"Plugin4Shell,\" a zero-click remote code execution flaw affecting four major AI coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI. Plugin marketplaces lock each plugin to a reviewed commit hash, but the agents never verify that the checkout actually landed on that commit. A repository owner can create a branch named like the pinned hash and point it at different code, so the agent installs it while still reporting the locked version.\n\nBecause Claude Code and Codex auto-update installed plugins by default, a swapped pin needs no user action. Attackers could either publish a benign plugin that turns malicious later, or hijack an existing plugin repository. Air found the flaw in May 2026 and notified vendors in June.\n\nAnthropic fixed the issue in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Google is retiring Gemini CLI and points users to its Antigravity environment, which is not affected, while GitHub Copilot still has no fix."}}